Executive brief
JetBrains PyCharm, a popular development environment for Python programmers, was vulnerable to a security flaw when opening untrusted projects. If a developer opened a project containing a malicious Python executable, the software could automatically run that code. This could allow an attacker to take full control of the developer's computer, potentially leading to the theft of source code, credentials, or other sensitive company data.
Technical details
A vulnerability classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) exists in JetBrains PyCharm. The issue occurs when the IDE processes an untrusted project that includes a specially crafted, malicious Python executable. Upon opening such a project, the IDE may execute the malicious binary without sufficient validation or sandboxing. This local attack requires user interaction (opening the project) but results in a scope jump (S:C), allowing for full compromise of the host system's confidentiality, integrity, and availability. The issue is fixed in versions 2026.1.4 and 2026.2.
Affected products
- JetBrains PyCharm before 2026.1.4, 2026.2
Timeline
- 2026-07-23: disclosed
- 2026-07-23: advisory